Hello there, I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer. Please find attached the minimized file causing the issue ("Input") and the ASAN report log ("Output"). Below is the reduced stacktrace with links to the corresponding source lines on a GitHub mirror. The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`. Let me know if there is any additional information I can provide. -- Input: 2304d75a49df935290e0c4edef5779a1.52037608e08ea640c3ff19ec097f9e72.min Output: 2304d75a49df935290e0c4edef5779a1.52037608e08ea640c3ff19ec097f9e72.txt Error in "versados_scan": SEGV on unknown address 0x000000000000 (pc 0x00000173e11e bp 0x7fffffffe130 sp 0x7fffffffdda0 T0) in versados_scan at bfd/versados.c:538 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/versados.c#L538) in versados_object_p at bfd/versados.c:645 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/versados.c#L645) in bfd_check_format_matches at bfd/format.c:311 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311) in display_object_bfd at binutils/objdump.c:3602 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602) in display_any_bfd at binutils/objdump.c:3693 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693) in display_file at binutils/objdump.c:3714 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714) in main at binutils/objdump.c:4016 (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)
Created attachment 10130 [details] testcase
Created attachment 10131 [details] report
The master branch has been updated by Nick Clifton <nickc@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=04f963fd489cae724a60140e13984415c205f4ac commit 04f963fd489cae724a60140e13984415c205f4ac Author: Nick Clifton <nickc@redhat.com> Date: Wed Jun 14 10:35:16 2017 +0100 Fix seg-faults in objdump when disassembling a corrupt versados binary. PR binutils/21591 * versados.c (versados_mkobject): Zero the allocated tdata structure. (process_otr): Check for an invalid offset in the otr structure.
Hi Aadamski, Thanks for reporting this bug. There were a couple of problems in the versados parser that led to this failure, but I have checked in a patch which should fix them. Cheers Nick